What is an agent sandbox?
An agent sandbox is an isolated computer where an AI agent can run programs, install dependencies and work with files safely.
On Runtime every agent sandbox is a Firecracker microVM with its own Linux kernel, and it bills only the CPU the agent uses. A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while the agent waits on its model, and a new one ran its first Python command 351 ms after the request at the median, measured on 24 September 2026 (speed).
Why AI agents need one
An agent writes code and then runs it. That code can loop forever, fill a disk, install anything, or follow a prompt injection that tells it to send your data somewhere. Running it on your own server or laptop puts your files, keys and network within its reach. A sandbox gives the agent a whole machine of its own that can be thrown away, with limits it cannot lift from inside.
What a good agent sandbox has
| Property | What to look for | On Runtime |
|---|---|---|
| Isolation | A boundary a kernel exploit cannot cross | A Firecracker microVM with its own kernel, every sandbox |
| A real computer | Shell, package managers, compilers, sudo |
Ubuntu 24.04, Python 3.12, Node.js 24, Bun, git, gcc; sudo works |
| Network control | Internet off, or narrowed to named hosts | Per-sandbox allow and deny lists, applied at once |
| Fast start | A fresh machine per task without a long wait | 351 ms median to first Python result (24 September 2026) |
| Kept state | Pause and resume with memory, not only files | Files, memory and processes kept 1 to 365 days |
| Spending limits | Caps the agent cannot raise itself | A daily limit per key, read-only keys, maxCostMicros per create |
| Agent interfaces | An SDK, a CLI and tools the agent can call | TypeScript, Python, CLI, HTTPS API and an MCP server |
Root inside a Runtime sandbox controls only the guest. Network rules, CPU, memory and cost are enforced on the host, outside the microVM (security).
How it works on Runtime
Create a sandbox, run the agent's command in it, and stop it when the block ends:
TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ timeoutSeconds: 300, onLeaseEnd: "stop" });await sbx.files.write("/workspace/task.py", "print(6 * 7)");const run = await sbx.exec(["python3", "task.py"]);console.log(run.exitCode, run.stdout);Pythonfrom withruntime import Sandboxwith Sandbox.create(timeout_seconds=300, on_lease_end="stop") as sbx: sbx.files.write("/workspace/task.py", "print(6 * 7)") run = sbx.exec(["python3", "task.py"]) print(run.exit_code, run.stdout)An array runs the program directly, with no shell, so arguments the model wrote cannot inject commands. An agent that works through tools instead of code can use the same sandbox through Runtime's MCP server.
What it costs
Runtime charges $0.025 per vCPU-hour of measured CPU, with a floor of a twentieth of a vCPU, and $0.0075 per reserved GiB-hour of memory. There is no plan fee. A thousand 60-second runs of a 2 vCPU, 4 GiB sandbox that use 20 CPU-seconds each cost $0.64 (pricing). New accounts get 50 free sandbox hours, no card.
Related
- How to run untrusted code from an LLM safely
- A sandbox for a coding agent
- What is a microVM?
- What is egress control?
- How to choose a sandbox for AI agents
Facts on this page were checked on 25 September 2026.